char pointers

Hello All,

I've been working on a program which writes to MySQL. It needs some variables posting into the database and I'm having trouble elegantly constructing a char * string to send to the MySQL connector.

Here's what I'm doing at present, apologies for my awful code, it works but seems unnecessarily long-winded and ugly. Does anyone know of a more elegant way to insert variables into a char * string? If there were a need for lots of SQL queries this method could get ugly very quickly!

Code:

---

char *arg1a = "select * from database where field1 = '";
char *arg1b = "' and field2 = '";
char *arg1c = "'";

char *sqlarg;

sqlarg = (char *)malloc((strlen(variable1) + strlen(variable2) + strlen(arg1a) + strlen(arg1b) + strlen(arg1c) + 1)

*sizeof(char));

strcpy(arg1, arg1a);
strcat(arg1, variable1);
strcat(arg1, arg1b);
strcat(arg1, variable2);
strcat(arg1, arg1c);

/* completed query now stored in sqlarg */

---

Thanks for any pointers (heehee)

See the make_message function at the end of snprintf(3): formatted output conversion - Linux man page

Then you could do something like

Code:

---

sqlarg = make_message( "select * from database where "
                      "field1 = '%s' "
                      "and field2 = '%s'",
                      variable1, variable2 );
if ( sqlarg != NULL ) {
  // do something SQL'ish
  free( sqlarg );
} else {
  // panic
}

---

Thanks, Salem. That code threw up some scary errors which I'm not experienced enough to figure out, but you did put me on the right track, and this seems to have got me going:

Code:

---

sprintf(query, "insert into database values ('%s', '%s')", field1, field2);

---

I read someplace this could be bad, but the snprintf manpage is, frankly, beyond my grasp at this point.

Quote:

---

Originally Posted by jhp

I read someplace this could be bad, but the snprintf manpage is, frankly, beyond my grasp at this point.

---

Yeah the problem with the sprintf is the bufferoverflow. Hence recommanded to use snprintf, so the second parameter to snprintf would be the length or the number of bytes to copy into char *str from source, without bufferoverflowing.

ssharish